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The Ultimate Guide To 
BACKGROUND CHECK 
COMPLIANCE 


New ban-the-box rules taking effect all over the country complicate FCRA compliance. And 
with stepped-up EEOC enforcement, you must tread carefully when considering candidates 
with criminal records. This step-by-step guide helps you stay on the right side of all these laws. 
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Focusing on just a few 
key areas can go along 
way toward keeping 
your compliance house 
in order. 


NOTE 

This guide offers suggestions 

and information, but don’t use 

it as legal advice. Always consult 
your own counsel if you have legal 
questions related to your specific 
practices and compliance with 
applicable laws. 


If recent class action lawsuits and EEOC actions have you scrambling to 
review your hiring practices, you’re not alone. Even seasoned HR pros 
have questions about how to play by background check and fair hiring 
rules. 


Focusing on just a few key areas can go a long way toward keeping 

your compliance house in order, according to Elizabeth McLean, FCRA 
Compliance Analyst and Attorney for GoodHire. These hot areas provide 
the highest return on your compliance investment. 


Like most HR professionals, you probably look into job candidates’ backgrounds before hiring 
them. When you use a vendor to run a background check, you have to follow federal, state, and 
even local laws that regulate employment screening. 


The Fair Credit Reporting Act (FCRA) is a federal law that sets out requirements for employment 
screeners like GoodHire, which the law calls consumer reporting agencies (CRAs). The FCRA also 
sets rules that the employers who use the reports must follow. 


Note that the FCRA only applies when an employer uses a third-party screener to perform a 
background check. If you send your own employees to the county court house or have them 
investigate applicants through online court databases, then the FCRA 

does not apply. 


In the past few years, even huge companies have been hit over and over again with class action 
lawsuits that allege FCRA violations. The danger of an FCRA violation lies in the availability of 
statutory damages. For each violation, an employer can be forced to pay 

up to $1,000. 


Imagine you’re a large company with an online application. You have thousands of applicants 
a year, and provide an electronic background check consent form to each. If that form isn’t 
compliant, you can be looking at a payout of $1,000 per applicant, plus attorney’s fees. This 
causes a lot of big-name employers to settle these lawsuits. 


And that creates a vicious cycle. Plaintiffs’ attorneys know that employers are more likely to 
settle when a class action lawsuit provides for statutory damages, so they file more lawsuits. 


How can you make sure you don’t join the list of businesses hit with an FCRA lawsuit? Most 
lawsuits arise from two go-to violations: 


1. Failure to provide a compliant background check disclosure and authorization form, which 
is a fancy way of saying a consent form. 


2. Failure to follow the three-step adverse action process the FCRA requires anytime an em- 
ployer intends to take unfavorable action (like deciding not to hire or promote) based on the 
results of a background check. 
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Non-Compliant Disclosure 


The FCRA states that an employer can’t obtain a background 
report unless a clear and conspicuous disclosure has been 
made in writing to the consumer in a document that consists 
solely of the disclosure. 


What does this mean? 


It means you have to inform your applicants in writing that a 
background check will be run for employment purposes. 
And you have to do that in a very clear way: 


You shouldn’t provide this disclosure within 
a job application 


You shouldn’t provide it in small font 


You shouldn’t sandwich it between 
information related to the duties of the job 


The disclosure MUST be provided in a document that 
contains only information about the background check. You 
can obtain authorization, or a signature, on this same page, 
but you shouldn’t include any information that’s unrelated to 
the background check. 


Many lawsuits filed against employers allege that the 
disclosure wasn’t clear and conspicuous and wasn’t provided 
in a stand-alone document due to the presence of “extrane- 
ous language.” 


For example, Nine West was sued because its consent form 
contained information related to work hours and at-will 
employment. Many companies are also sued because of the 
presence of a single release of liability clause. It seems silly that 
a class of applicants could be awarded statutory damages 

for these things. But these “hypertechnical” violations of the 
FCRA are real threats. 


Disclosure Compliance 


Take a moment to review your background check consent forms. Make sure: 


af Your consent forms aren’t sandwiched in the middle of an application package 


af The disclosure doesn’t contain a release of liability or any information unrelated to the background check itself 


wy No state law disclosure is listed on the consent form - put it in a separate document 


Several states require specific notices be provided to applicants before running a background check. Until recently, most employ- 
ers and CRAs included these state law notices in the same document as the disclosure and authorization. And it made sense. The 
rights were related to the background check, so you’d think that they couldn’t be considered “extraneous.” 


But, in 2019, the 9th Circuit Court of Appeals settled this question in Gilberg vs California Check Cashing Stores, ruling that 
California Check Cashing Stores violated the FCRA by including state-specific disclosure notices in the same document as the 


FCRA disclosure form. 
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Adverse Action Violations 


The second most popular FCRA claim alleges a violation of 
the adverse action process. If an employer has obtained a 
background check from a CRA and intends to take unfavor- 
able action against an applicant based on that check, it MUST 
follow what’s called the “adverse action process.” 


Most of the time, lawsuits that allege adverse action violations 
are based on the employer’s failure to send the pre-adverse 
notice or to wait five days in between the first and last notice. 


The good news is that this process is simple and easy to 
follow. As a best practice, keep a record of all pre-adverse and 
post-adverse action notices sent along with the dates sent. If 
you’re handling the process yourself and you haven’t con- 
tracted with your CRA to send the notices on your behalf, you 
may want to consider sending these notices by by certifified 
mail, or electronically by email. 


Adverse Action Compliance 


wy Send out a pre-adverse action notice. 


This is just a letter that informs the applicant that the background check is under review and a decision is pending. 
You have to provide a copy of the background report and what’s called “a Summary of Rights” along with the notice. 
The Summary of Rights is a document provided by the Consumer Financial Protection Bureau, and you can find it on 


their website. 


Wait five business days. 


After providing the pre-adverse notice, you must provide time for the candidate to respond (to dispute the information, 
for example). Five business days is usually considered adequate. 


Send the final adverse action notice. 


After waiting five days, if you still want to reject the applicant, you must send the final adverse action notice. This notice must: 


was not the decision maker 


dispute inaccurate information 


Inform the applicant of the adverse action (denial of employment) 
Notify the applicant that the decision was based, at least in part, on the background check 


Contain the contact information for the CRA that performed the background check and a statement that the CRA 


Inform the applicant of his or her right to request a free copy of the report within 60 days and of the right to 


If you leave out any of these requirements in the final notice, you’re in violation of the statute. So review these notices and 
audit them annually to make sure they comply with what the law currently requires. 
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Other Risks To Watch 


A special exception to the FCRA lets an employer run a post-hire 
background check on an employee without obtaining consent. This 
can only be done if the report is run as part of an investigation into 
employee misconduct. It’s not an exception that’s widely used. 


Many employers require drug screening as part of the hiring process. 
Keep in mind that drug tests can only be performed after a conditional 
offer is made to a candidate. 


New Laws Restrict Credit Check Use 


Credit reports are consumer reports, just like background checks. Federal regulations on 
using credit reports and criminal background checks in the hiring process are the same: the 
FCRA applies. 


This means you must get compliant disclosure and authorization just as you would for a 
background check and you must follow the adverse action process if you take unfavorable 
action against a candidate based on information in a credit report. 


But credit reports are recently creating more compliance challenges for employers because 
states are passing their own laws that regulate the use of credit checks for employment pur- 
poses. Like most employment screening laws, these state-level credit reporting restrictions 
vary by location. 


The common theme in the states that have enacted credit report restrictions is that the use of 
credit history is PROHIBITED unless the employer or employee falls into a special category. 
These categories are usually those in which an applicant would: 


e Handle large amounts of money 

e Work ina managerial capacity 

e Have access to trade secrets 

e Work ina field (such as financial services) in which regulations require credit reports 


Research your state’s laws and make sure you’re familiar with any credit report restrictions. 


Don’t forget to check for city regulations. New York City, for example, has a very stringent law. 
The Stop Credit Discrimination in Employment Act (SCDEA) prohibits most employers from 
running credit reports on their applicants. An employer found in violation of that credit 
restriction can be fined up to $250,000. 


Other locations provide for civil penalties, injunctive relief, and even “private right of action,” 
which means you can be sued in court for damages. 


Consult your counsel if you have questions about state and local regulations that apply. 
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STATES, CITIES 
AND COUNTIES 


HAVE 


BAN-THE-BOX 


LAWS IN 
PLACE 


No Uniform Rules Regulating Timing 


Many employers are confused as to when they can legally run a background check on an ap- 
plicant or employee. That confusion is completely understandable because there’s no uniform 
rule that regulates when an employer can screen an employee or job candidate. 


The timing of a background check depends on a number of different factors. In the pre-hire 
stage, you’ll want to consider two laws: 


e FCRA, which lets you run a background check for employment purposes at any point, as 
long as you obtain consent 


e Ban-the-box regulations, which provide more protection to job applicants and vary among 
states and municipalities 


Ban-the-box laws usually require that the background check be delayed until after the first 
interview or until after a conditional offer is made. Check the ban-the-box guide from the 
National Employment Law Project to see if you’re located in a jurisdiction with a ban-the-box 
law in place (and check with your counsel for specific advice). 


If you’ve made a conditional offer or have already formally hired a candidate, the FCRA lets you 
run a background check at any point as long as you get consent. Many employers also insert 
what’s called an “evergreen” clause into their disclosure and authorization form that states 
they may run subsequent background checks on the employee throughout the duration 

of employment. 


These have been upheld as valid in most states. In California, however, there’s a gray area that 
suggests employers in that state must get consent for each report - evergreen provisions aren’t 
valid. In New York, if you are running a background check that includes references, then you 
must get a separate consent for that check as well. 


In general, though, you can do “post-hire monitoring” on employees without having to get new 
consent each time. You just have to make sure you put the evergreen language into that first 
consent form. 


` 
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Source: National Employment Law Project, 2020 
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When it comes to background screening, the EEOC 
has alleged disparate impact discrimination 
against employers whose screening policies result 
in disproportionate adverse treatment toward a 
orotected group, usually a racial minority. 


Increased Enforcement Of Title VII 


The Equal Employment Opportunity Commission (EEOC) 
has taken action against companies in some very high profile 
cases lately. 


Since 2012, the Commission has been focused on increasing 
its enforcement efforts against employers for violations of 
Title VII of the Civil Rights Act of 1964. This statute prohibits 
employer discrimination based on race, color, religion, sex, or 
national origin. There are two types of discrimination in Title 
VII claims: 


e Disparate treatment, in which an employer intentionally 
discriminates against a protected group 


e Disparate impact discrimination, in which an employer’s 
actions result in unintended discrimination against a 
protected group 


When it comes to background screening, the EEOC has alleged 
disparate impact discrimination against employers whose 
screening policies result in disproportionate adverse treat- 
ment toward a protected group, usually a racial minority. 


In fact, the EEOC’s 2012 enforcement guidance specifically 
states: “With respect to criminal records, there is Title VII 
disparate impact liability where the evidence shows that a 
covered employer’s criminal record screening policy or 
practice disproportionately screens out a protected group 
and the employer does not demonstrate that the policy or 


practice is job related for the position and is consistent with 
business necessity.” 


Two recent high-profile cases resulted in very different 
outcomes: 


EEOC v. Freeman 

The Commission alleged that the use of background checks 
and credit checks led to disparate impact discrimination for 
which there was no business necessity. The 4th Circuit Court 
of Appeals threw out the case and chastised the Commission 
for lack of evidence and sweeping claims. 


This caused many people to believe the EEOC would lighten 
up on background screening discrimination cases. But that’s 
not what happened. 


EEOC v. BMW 

In September of 2015, the EEOC won a huge victory against 
BMW. The Commission alleged the company’s background 
screening policy resulted in disparate impact discrimination. 
After rounds of litigation, BMW entered into what was effec- 
tively a settlement. They had to pay $1.6 million in damages 
to the class of claimants who were terminated from their jobs 
at the car factory as a result of the background screening 
policy. 
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This win may mean that the EEOC will continue to try cases based on background screening policies. This means you need to 
follow best practices so that you aren’t contacted by the EEOC. 


Background screening policies that result in discrimination can be compliant as long as you can demonstrate business necessi- 
ty and relevance to the job. To demonstrate this: 


oO Consider the “Green factors.” 
Named for the case (Green v. Missouri Pacific Railroad) in which they were announced, Green factors include: 
e The nature and gravity of the offense 
e The time elapsed since the offense 
e The nature of the job sought 


Even if you determine the applicant is not a good fit, documenting this process can help protect you from a Title VII suit. 


| Perform individualized assessments for any applicants who have criminal records. 
This means you should: 
e Ask for more information about the offense to get context 
e Give them the opportunity to explain 


| Limit the scope of your background screenings to 7 to 10 years. 
Many employers request all available criminal record information, but that makes it more difficult to demonstrate that 
your policy is based on necessity. Misdemeanors from 20 years ago aren’t going to be very relevant if the applicant has 
had no criminal conduct since that time. 


uw Remove the criminal conviction inquiry from your job applications. 
Many states have adopted ban-the-box laws that require employers to remove this question from their applications, and 
it’s just a matter of time before your jurisdiction catches up. Removing it now saves you from a rush to do so after a law 
has been passed in your state. 
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The hope is that ban-the-box laws will 
reduce,recidivism by giving people with criminal 
records a better chance at employment. 


Ban-The-Box Legislation 


The ban-the-box movement aims to give ex-offenders a better 
chance at employment. These laws typically require employ- 
ers to remove the box that asks applicants about their convic- 
tion history from their employment applications. The hope is 
that the protections given under ban-the-box laws will 

reduce recidivism. 


Ban-the-box laws vary by state, county and city. Some leg- 
islation restricts only public employers, some restricts both 
public and private employers. Some only prohibit employers 
from asking for criminal record history on the application. 
Other states go further and require employers wait until after 
the first interview or after a conditional offer to inquire into 
criminal history. Some locations require employers to send 
specific notices or reasons as to what led to an adverse action. 


As of November 2020, thirty-six states states have passed ban-the-box legislation, and many of these currently impose re- 
strictions on private employers. Even privately owned small businesses need to pay attention to this trend. Follow these best 


practices for ban-the-box awareness and compliance: 


M Check the 


guide from NELP as a first step to find out whether you’re in a ban-the-box location. 


M Remove questions about prior convictions from your applications. 


“M If you must keep the question on your application, provide room for the applicant to explain any convictions 


and provide relevant information. 


M Keep up with legislation. Using Google Alerts let you get daily updates about ban-the-box, EEOC, and FCRA 


developments in your email. 
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Candidate Experience 
Help For Individualized Assessment 


To comply with EEOC guidance, employers need to individually assess 
candidates in order to consider the age of the offense, relevance to the 
job, and other factors. The challenge for you is to do that in a way that 
not only complies with employment law, but also respects the person 

behind the record. 


GoodHire’s award-winning candidate experience lets candidates and 
employees save comments about their records directly to their 
background check results. Comments For Context helps you get the 
individualized context the EEOC requires, making it less likely your policies 
will be found to be overly broad and unrelated to business necessity. 

By empowering candidates to take ownership of their information, 
Comments For Context helps you and your potential hires hit it off 

from the start. 


Candidates can provide 
more information about 
their records directly in the 
background check. 


— Criminal Record #1 


Federal Criminal Data 


Offender Details 
93202442332 


Name 


Douglas County 


Date of Birth 4/11/1963 


SSN XXX-XX-7890 


Irina Foxtrotter 


4/11/1963 


XXX-XX-7890 
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GoodHire’s in-house compliance expertise is unparalleled. 
Find out what we can do for your business. 


GoodHire 


GoodHire provides customizable background screening services for business of all sizes. Through innovative, secure 
technology, integrations with leading HR platforms, and built-in compliance workflows, GoodHire speeds and simplifies 
the background check process to help customers build teams based on trust, safety, and fairness. Its award-winning 
platform empowers applicants to take ownership of their information, and enables employers to make individualized 
assessments for fair hiring decisions. GoodHire is owned and operated by Silicon Valley-based Inflection, a leader in 
trust and safety solutions since 2006. © 2020 Goodhire. All Rights Reserved. 


